Location : Montréal

Summary

The role of the Lead, IT Cybersecurity Governance and Compliance, reporting to the IT Director, is to structure and evolve the organization’s cybersecurity program while ensuring alignment with the regulatory, contractual and operational requirements specific to an aerospace and defense environment.

The incumbent acts as a key resource for compliance initiatives, audits, risk management, security documentation, user awareness, and interactions with customers, partners, auditors and certification bodies.

This position combines a governance and compliance component, a documentation-writing component — including policies, procedures, standards, guides and compliance evidence — as well as a training and customer representation component.

Responsibilities

Strategy & Planning

·   Implement, maintain and oversee the application of cybersecurity and compliance policies, procedures, standards and related plans.

·   Contribute to the development and maintenance of the cybersecurity roadmap, including governance, compliance and risk reduction priorities.

·   Participate in technology risk assessments and recommend appropriate corrective measures.

·   Support compliance initiatives related to CMMC, NIST 800-171, DFARS, ITAR, CGP and other applicable requirements.

·   Participate in the preparation, coordination and follow-up of internal, external, customer and regulatory audits.

·   Contribute to the development and updating of business continuity and disaster recovery plans.

Governance, Compliance and Documentation

·   Write, maintain and update policies, procedures, standards, operational guides and compliance documents.

·   Maintain the compliance evidence, registers, logs and documentation required for audits and customer requests.

·   Participate in the creation of templates, processes and guides to standardize cybersecurity practices.

·   Coordinate the collection of evidence from the IT, engineering, operations and business teams to support IT & Cybersecurity compliance obligations

·   Contribute to the continuous improvement of the cybersecurity governance and risk management program.

Acquisition & Deployment

·   Interact with suppliers, subcontractors and consultants to assess or acquire cybersecurity services and products.

·   Participate in third-party risk assessments and in the follow-up of mitigation plans.

·   Recommend, plan and support security solution improvements, upgrades and deployments.

·   Collaborate on modernization projects involving identity and access management (IAM), workstations, servers, networks, cloud environments and monitoring tools.

Training, Awareness and Representation

·   Develop, maintain and deliver cybersecurity awareness and training activities for employees, managers and IT teams.

·   Participate in phishing simulation campaigns, security communications and initiatives promoting the adoption of best practices.

·   Represent the organization in discussions with customers, partners, auditors and certification bodies on cybersecurity and compliance topics.

·   Contribute to responses to customer security questionnaires, evidence requests, compliance reviews and cybersecurity verifications.

·   Act as a facilitator between cybersecurity requirements, operational needs and the expectations of internal and external customers.

Requirements

·   Bachelor’s degree in computer science, cybersecurity or governance.

·   Minimum of eight (8) years of relevant experience in cybersecurity, information security, compliance or technology risk management.

·   Hands-on experience in a complex, regulated IT environment or one subject to contractual security requirements.

·   Bilingual in French and English, with very strong professional writing skills.

·   A security, governance or audit certification is an asset: CISSP, CISM, CISA, CRISC, Security+, Network+ or equivalent

Knowledge

·   Theoretical knowledge of IT infrastructure systems, security systems, data encryption and information protection practices.

·   Theoretical knowledge of SIEM, MDM, EDR, IAM, SSO, MFA and FW principles.

·   Solid understanding of governance, risk management and compliance (GRC) principles, including control assessment, action plan follow-up and maintenance of compliance evidence.

·   Knowledge of applicable privacy and data protection practices and laws.

·   Knowledge of requirements or frameworks such as CMMC, NIST 800-171, DFARS, ITAR, CGP, ISO 27001, Cyber Essentials or NIS2 is an asset.

Personal Qualities

·   High level of analytical and problem-solving skills.

·   Excellent writing, synthesis and knowledge-popularization skills.

·   Strong interpersonal skills and ability to interact with customers, auditors, suppliers and internal teams.

·   Ability to lead training sessions and support users in adopting best practices.

·   Rigor, autonomy, organizational skills and excellent attention to detail.

·   Ability to prioritize and execute tasks efficiently in a high-pressure environment.

·   Ability to work in a collaborative, team-oriented environment.

·   High sense of confidentiality, ethics and customer service.

·   Proactive and focused on continuous improvement.

Working Conditions

·   Occasional availability outside regular hours to support interventions, installations, configurations, audits or critical incidents.

·   On-site presence when required for activities related to infrastructure, audits, training or interactions with operational teams.

CMC is committed to employment equity and to the equal access program. CMC encourages members of designated groups to apply for jobs. Please note that the use of the masculine gender is only intended to lighten the text.